Sophos News

Privacy dust-up as Roomba maker mulls selling maps of users’ homes

iRobot, maker of the cat chariot-cum-auto-vacuum Roomba robot, is looking into selling maps of our homes to one of the Big Three companies behind artificially intelligent (AI) voice assistants – Google, Amazon and/or Apple.

What does the Roomba know about us? Well, the data points its higher-end models collect include your home’s floor plan, the rough dimensions of everything located on your floor, the areas of your home that require the most cleanup and hence likely see the most activity, how often you clean, and the distances between all your stuff.

iRobot CEO Colin Angle told Reuters that this kind of spatial data is just the ticket when it comes to helping a smart home get over its dumbness about our physical environments:

There’s an entire ecosystem of things and services that the smart home can deliver once you have a rich map of the home that the user has allowed to be shared.

Examples given by Guy Hoffman, a robotics professor at Cornell University: sound systems that could match home acoustics, air conditioners that can schedule airflow by room, or smart lighting that can adjust according to time of day and window position. Plus, of course, the more data that companies like Amazon, Google or Apple have on us, the better they can market home goods at us.

In fact, iRobot made Roomba compatible with Amazon’s Alexa voice assistant in March, as in, “Alexa, ask Roomba to begin cleaning.”

Angle told Reuters that iRobot could reach a deal to sell spatial maps of homes to Google, Amazon, and/or Apple in the next couple of years. It’s already in active discussions with Amazon and Google about its ongoing effort to add Alexa and Google Assistant functionality to the Roomba line, Angle told Tech Crunch. Neither Amazon, Apple nor Google have so far commented on the news.

Privacy advocates’ response: you can wheel that privacy-hoovering notion right off a steep staircase.

Tech Crunch reports that, following a flurry of articles and a load of ears pricking up on the privacy front, iRobot seems a bit taken aback. Angle has, after all, been talking about integrating mapping with Alexa since March.

It’s stressing that, as Angle said in his interview with Reuters (which took place in May), selling off maps of users’ homes to the highest bidder is going to be strictly opt-in. From a statement Angle sent to Tech Crunch:

iRobot takes [the] privacy and security of its customers very seriously. We will always ask your permission to even store map data.

iRobot has not formed any plans to sell the data. We do hope to extract value from the information, but would only do so with the permission of our customers… But to be clear, this is only if you opt in. It is still unclear what – if any – actual ‘partnerships’ would be needed to make that happen.

Roomba owners can opt out of cloud-sharing within the iRobot Home app. But as Gizmodo found when squinting at iRobot’s privacy policy, the legalese states various situations in which it will indeed share user data with third parties.

That includes typical scenarios: iRobot can share your data internally, with subsidiaries, third-party vendors, and the government, upon request. Nothing surprising there. Plus, users have to give consent to share data with third parties for marketing purposes.

But keep reading and you’ll find that there are plenty of cases where it doesn’t need our say-so to share our data:

We may share your personal information with other parties in connection with any company transaction, such as a merger, sale of all or a portion of company assets or shares, reorganization, financing, change of control or acquisition of all or a portion of our business by another company or third party or in the event of bankruptcy or related or similar proceeding.

As Angle stressed, the map sharing is just in the talking stages at this point. Hopefully, the privacy concerns it’s causing will help to shape how the data sharing opt-in will look when it goes live.

Will it be in teensy type, buried in a lengthy legal document? Or will it be a whole lot easier for users to spot?

Let’s hope it’s the latter. After all, this is the infamous Internet of Things (IoT) we’re talking about. This is the place where data too often gets swept up and put into bags that have holes.